Dell PowerFlex Manager
CVE-2026-22283
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no attacker auth but requires operator interaction and non-trivial conditions (AC:H, UI:R); description scopes impact to information disclosure only, so I and A set to N.
Primary rating from Vendor (dell).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Dell PowerFlex Manager, version(s) Version prior to 4.8, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an untrusted control sphere (CWE-829), allowing remote attackers to obtain sensitive data when a user is enticed into interacting with attacker-controlled content. Dell rates the issue at CVSS 7.5 with high attack complexity and required user interaction, and no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Dell PowerFlex Manager at a version prior to 4.8 to be reachable by the attacker over the network, and a legitimate PowerFlex Manager user must perform an interaction (UI:R in the CVSS vector) that causes the manager to include functionality from an attacker-controlled source - consistent with CWE-829. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated path but with high attack complexity AND required user interaction, which significantly tempers the headline 7.5 score - successful exploitation depends on a privileged operator being induced to trigger the vulnerable flow under specific conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts malicious content (a crafted template, link, or external resource) and lures a logged-in PowerFlex Manager operator into interacting with it - for example via a spear-phishing message referencing a storage operations task. When the operator clicks through, the management console loads attacker-influenced functionality from the untrusted source and returns sensitive data accessible in the operator's session back to the attacker. |
| Remediation | Upgrade Dell PowerFlex Manager to version 4.8 or later as directed by Dell advisory DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities); this is the vendor-released patch and the only confirmed remediation path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Dell PowerFlex Manager deployments and identify systems running versions prior to 4.8. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Share
External POC / Exploit Code
Leaving vuln.today